rewriting rule does not work on jquery.get()? - ajax

Question

initally, i'm sorry about my question-title, but really nothing better came into my mind....
i've got a .htaccess file that does the "usual" rewriting:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule ^(.+)$ index.php?url=$1 [QSA,L]
this gives me the possibility of have this url for example (i'm working with xampp):
localhost/<project>/en/products/electronic/television/
so this url is in the $_GET['url'] variable and i can use it (as an array) to load the controller in my HMVC pattern.
and, to not have to enter the language ("en" in the example above), i've implemented a function that inserts automatically "en". basically that means the following url gives the same controller, and respectively the same output.
localhost/<project>/products/electronic/television/
but now i wonder, that my javascript files (jquery & co), that are lying in the folder
<project>/lib/js/query/jquery.min.js
can be simply required like this:
<script type="text/javascript" src="/<project>/lib/js/jquery/jquery.js"></script>
i expected that the requested path would eventually be something like this (as i add the language in the $_GET['url'] variable and it would try to load a controller and fails...
src="/<project>/en/lib/js/jquery/jquery.js"
well, in that case i would be glad that it works this way, but it brought me to the idea to try this:
$(document).ready(function() {
alert("this is a test");
$.get("/<project>/<config-dir>/<config-file>", function(data) {
alert(data);
});
});
voila, it outputs the config file.
i think that the behavior will be the same on a productive server, but then just without the "/" nodes in the paths.
how can i prevent this, without moving the config-file from document root?
basically, i've ensured that XSS-attacks won't (almost) be unsuccessful. the "almost" just because there is no 100% safety.
i hope i expressed myself well :)
thanks for the help/suggestions.

Answer 1

well, i found out, what the problem was, why i could access the config file: the rewrite conditions. they say simply, that the following rule should became effective if the requested filename is not a directory or file or link(?).
RewriteEngine On
# RewriteCond %{REQUEST_FILENAME} !-d not a directory
# RewriteCond %{REQUEST_FILENAME} !-f not a file
# RewriteCond %{REQUEST_FILENAME} !-l not a link(?)
RewriteRule ^(.+)$ index.php?url=$1 [QSA,L]
so basically this explains, why the rewriting rule did not work on ajax-requests (it did not work on normal requests as well)
now my problem with unallowed access is solved.
to exclude some specific directories from the rewrite rule i added this rule for:
RewriteRule ^(<dirname>)($|/) - [L]